FPGA-based line-speed bit mask message matching method and device

Abstract

This application discloses a line-speed bit mask message matching method based on an FPGA. The FPGA includes at least one block RAM, which includes multiple storage addresses. The method includes: obtaining N matching rules, each of which includes a rule number, a keyword, and a mask; configuring the matching rules in the block RAM according to the N matching rules: for each matching rule, determining at least one storage address corresponding to the matching rule based on the valid bits of the mask in the matching rule and the corresponding keyword; determining the bit to be configured among the N bits of the storage address using the matching rule number, and writing the valid bit value into the bit; using the quintuple information in the received message as the storage address of the block RAM, reading multiple valid bit values corresponding to the storage address, and determining the rule number of each matching rule hit by the message based on the valid bit value. This application can achieve line-speed bit mask rule matching of messages.

Description

Technical Field

[0001] The present application relates to the field of message matching technology, and in particular to a line-speed bit mask message matching method and device based on FPGA. Background Art

[0002] When performing specific processing on specific messages in the network, it is usually necessary to configure message rules on the network device. In the related technical solution, after the network device receives the message, it extracts the five-tuple information from the message, and adopts the mask five-tuple matching method and hash algorithm to match the message rules to achieve fast data packet matching, but it will reduce the accuracy of message matching. The mask rule function is usually implemented by a TCAM chip (ternary content addressable memory). For application scenarios of message processing that do not require a high number of rules, the chip is relatively expensive, which leads to an increase in product cost, and there is a bandwidth bottleneck that makes it impossible to achieve line-speed matching. Summary of the Invention

[0003] The purpose of this application is to provide a line-speed bit mask message matching method and device based on FPGA, which can realize line-speed message rule matching and reduce product costs.

[0004] In a first aspect, the present application provides a line-speed bit mask message matching method based on an FPGA, wherein the FPGA includes at least one block RAM, the block RAM includes multiple storage addresses, and the storage space corresponding to the storage address has N bits. The method includes:

[0005] Obtain N preset matching rules, each matching rule including a rule number, a keyword, and a mask corresponding to the keyword, wherein the rule number ranges from 0 to N-1, and N is a natural number;

[0006] Performing matching rule configuration in the block RAM according to the N matching rules, the matching rule configuration step comprising: for each matching rule, determining at least one storage address corresponding to the matching rule based on valid bits of a mask in the matching rule and a corresponding keyword, determining a bit to be configured among the N bits of the storage address based on the rule number of the matching rule, and writing an effective bit value indicating that the matching rule is effective into the bit to be configured;

[0007] The received message is parsed to generate quintuple information, the quintuple information is used as the storage address of the block RAM, multiple valid bit values corresponding to the storage address are read, and the rule numbers of each matching rule hit by the received message are determined based on each valid bit value.

[0008] In a second aspect, the present application provides a line-speed bit mask message matching device based on an FPGA, wherein the FPGA includes at least one block RAM, the block RAM includes multiple storage addresses, and the storage space corresponding to the storage address has N bits. The device includes:

[0009] An acquisition module is used to obtain N preset matching rules. Each matching rule includes a rule number, a keyword, and a mask corresponding to the keyword. The rule number ranges from 0 to N-1, where N is a natural number.

[0010] a rule configuration module configured to configure the matching rules in the block RAM according to the N matching rules, the matching rule configuration steps comprising: for each matching rule, determining at least one storage address corresponding to the matching rule based on the valid bits of the mask in the matching rule and the corresponding keyword, determining a bit to be configured among the N bits of the storage address based on the rule number of the matching rule, and writing an effective bit value indicating that the matching rule is effective into the bit to be configured;

[0011] The message matching module is used to parse the received message to generate five-tuple information, use the five-tuple information as the storage address of the block RAM, read the multiple effective bit values corresponding to the storage address, and determine the rule number of each matching rule hit by the received message based on the various bits corresponding to each effective bit value.

[0012] In a third aspect, the present application provides a communication device, comprising the FPGA-based line-speed bit mask message matching device as described above.

[0013] This application implements the configuration of matching rules in block RAM based on preset matching rules. It can directly use quintuple information as the read address of the block RAM to perform rule matching searches in the block RAM, achieving line-speed message rule matching and improving message matching accuracy. By utilizing the block RAM within the FPGA to store matching rules and implement rule matching for messages, the application eliminates the need for an external TCAM solution, reducing product costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 A first flow chart of a line-speed bit mask message matching method based on FPGA provided in an embodiment of the present application;

[0015] Figure 2 A second flow chart of the FPGA-based line-speed bit mask message matching method provided in an embodiment of the present application;

[0016] Figure 3 A third flow chart of the FPGA-based line-speed bit mask message matching method provided in an embodiment of the present application;

[0017] Figure 4 A fourth flow chart of the FPGA-based line-speed bit mask message matching method provided in an embodiment of the present application;

[0018] Figure 5 A fifth flow chart of the FPGA-based line-speed bit mask message matching method provided in an embodiment of the present application;

[0019] Figure 6 A sixth flow chart of the FPGA-based line-speed bit mask message matching method provided in an embodiment of the present application;

[0020] Figure 7 A seventh flow chart of the FPGA-based line-speed bit mask message matching method provided in an embodiment of the present application;

[0021] Figure 8 An eighth flow chart of the FPGA-based line-speed bit mask message matching method provided in an embodiment of the present application;

[0022] Figure 9 A system block diagram of a line-speed bit mask message matching device based on FPGA provided in an embodiment of the present application;

[0023] Figure 10 A system block diagram of the communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] The present application will be described in detail below in conjunction with the specific embodiments shown in the accompanying drawings, but these embodiments do not limit the present application. Structural, methodological, or functional changes made by ordinary technicians in this field based on these embodiments are included in the scope of protection of the present application.

[0025] Please refer to Figure 1 , an embodiment of the present application provides a line-speed bit mask message matching method based on FPGA, the method comprising steps S101-S103.

[0026] S101, obtaining N preset matching rules, each matching rule including a rule number, a keyword, and a mask corresponding to the keyword, the rule number is 0 to N-1, and N is a natural number.

[0027] N user-configured matching rules can be obtained through software commands. Each matching rule includes a rule number, a keyword, and a mask corresponding to the keyword. Users can configure multiple types of keywords and corresponding masks based on their needs. Keywords can be understood as five-tuple information or feature code information, and the mask is the mask corresponding to the five-tuple or feature code. The five-tuple information includes the source IP address, destination IP address, source port, destination port, and protocol number. Correspondingly, the mask includes the source IP address mask, destination IP address mask, source port mask, destination port mask, and protocol number mask; the feature code information is a series of bytes in the message parsed by the user that meet certain characteristics. The keyword and mask fields have the same length. The keyword represents the specific value of each matching rule, and the value of each bit in the mask indicates whether the same bit in the keyword is valid, that is, which values in the keyword need to be matched, and is used to indicate the valid bits in the keyword.

[0028] An FPGA includes at least one block RAM (block random access memory). Block RAM is internal memory within the FPGA. The block RAM includes multiple memory addresses, each of which has N bits of memory space.

[0029] Exemplarily, the number of bits of storage space corresponding to each storage address in the block RAM is equal to the number of preset matching rules. Assuming N is 72, and the matching rule numbers are 0-71, each storage address corresponds to 72 bits of storage space, represented by bits 0-71. When bit 0 is 1, rule 0 is in effect; when bit 0 is 0, rule 0 is not in effect. When bit 1 is 1, rule 1 is in effect; when bit 1 is 0, rule 1 is not in effect, and so on. Assuming the keyword value range is 0x00-0xFF, a block RAM with 256*72 storage space can be selected. The depth of the block RAM is related to the byte length of the keyword. The number of bits of storage space corresponding to each storage address in the block RAM is equal to the number of preset matching rules. Therefore, the size of the block RAM storage space can be determined based on the byte length of the keyword and the number of matching rules. It is understood that if the byte length of the keyword is relatively long and the byte length of a single block RAM address cannot meet the requirement, multiple block RAMs can be used to implement rule configuration. The number of block RAMs required can be determined based on the byte length of the keyword. For example, if the byte length of the keyword is 4 bytes and the storage depth of the block RAM supported by the FPGA is 2 bytes, the regular configuration can be implemented through two identical block RAMs.

[0030] S102, performing configuration of matching rules in the block RAM according to N matching rules, the configuration steps including: for each matching rule, determining at least one storage address corresponding to the matching rule according to the valid bits of the mask in the matching rule and the corresponding keyword, determining the bit to be configured among the N bits of the storage address by the rule number of the matching rule, and writing the effective bit value used to represent the effectiveness of the matching rule into the bit to be configured.

[0031] In this embodiment, according to N preset matching rules, the matching rules are converted based on mask matching rules to implement the configuration of a five-tuple matching rule in the block RAM. This allows rule matching of keywords in the message to be implemented using the matching rules stored in the block RAM. Specifically, for each matching rule, at least one storage address corresponding to the matching rule is determined based on the valid bits of the mask in the matching rule and the corresponding keyword. The bit to be configured among the N bits of the storage address is determined based on the rule number of the matching rule. An effective bit value is written into the bit to be configured, indicating that the matching rule is effective. For example, if the rule number of the matching rule is 2, the bit to be configured among the N bits is 2, and the effective bit value is 1, then the bit value 1 is written into bit 2.

[0032] For example, assume that matching rule 1 is configured as follows: rule number 1, keyword 0x20, and corresponding mask 0x2F. Mask 0x2F has a binary format of 00101111. A bit value of 0 in the mask indicates an ignore, and a bit value of 1 indicates a match. Therefore, bits 7, 6, and 4 in mask 0x2F have values of 0, meaning the ignored bits are 7, 6, and 4. Keyword 0x20 has a binary format of 00100000. Based on the mask rule, the correspondence between keyword 0x20 and mask 0x2F indicates that any data that conforms to the format of **1*0000 satisfies matching rule 1. Therefore, in the configuration of the block RAM matching rule, bit 1 in each storage address that conforms to the format of **1*0000 is configured with an effective bit value. For example, bit 1 is configured to 1 in storage locations with addresses 00100000, 00110000, and 01100000. Therefore, after configuring the five-tuple matching rule based on the block RAM, if the keyword in the message matches the **1*0000 format and the bit value read from bit 1 of the corresponding storage address is 1 during the matching and rule search in the block RAM, it means that the message hits rule 1. For example, if the keyword in the message is 0x20, the bit value read from bit 1 of the storage address 0x20 in the block RAM is 1, and the message is judged to hit rule 1. This method can directly search for the keyword in the message in the block RAM, achieving the purpose of accurate message matching.

[0033] S103, parse the received message to generate quintuple information, use the quintuple information as the storage address of the block RAM, read multiple valid bit values corresponding to the storage address, and determine the rule numbers of each matching rule hit by the received message based on each bit position corresponding to each valid bit value.

[0034] Obtain the received message, parse the message, and obtain the five-tuple information or feature code information in the message. The five-tuple information includes the source IP address, the destination IP address, the source port, the destination port, and the protocol number. Perform rule matching based on the five-tuple information, use the five-tuple information as the storage address of the block RAM, that is, use the five-tuple information as the read address of the block RAM, read out the bit values of the corresponding bits, and determine the effective bit values according to the read bit values. According to the above scheme, it can be seen that the bit position of the effective bit value corresponds to the rule number of the matching rule. Therefore, based on the bits corresponding to the effective bit values, the rule numbers of the matching rules hit by the message can be determined. When the match is successful, the message is processed according to the processing action defined in the successful matching rule. For example, if the processing action is passed, it is forwarded accordingly, and if the processing action is not passed, the message is discarded.

[0035] When multiple rules are matched, arbitration is performed based on the priority of each matching rule. The final result is determined based on the priority stored in the rule, and the matching rule with the highest priority is usually output. The priority of the matching rule can be set according to the actual needs of the user.

[0036] For example, assuming that the effective bit value is set to 1, the block RAM in the above example has 72 bits. If the values of bits 1, 6, and 8 read from a storage address of the block RAM corresponding to the quintuple information are 1, then the rules matched by the quintuple are rules 1, 6, and 8. Assuming that the user-defined matching rule priority is: the smaller the rule number, the higher the priority, the rule number matched by the quintuple is 1; assuming that the user-defined matching rule priority is: the larger the rule number, the higher the priority, the rule number matched by the quintuple is 8.

[0037] In an embodiment of the present application, according to a preset matching rule, the matching rule is converted based on the mask matching rule to implement the configuration of the matching rule in the block RAM. The matching rule stored in the block RAM can be used to implement rule matching of keywords in the message. The five-tuple information can be directly used as the read address of the block RAM to search for rule matching in the block RAM, which can quickly implement rule matching of the message. The block RAM is the internal memory of the FPGA. Compared with the data reading and writing of the external memory, its read and write speed is faster, which can further improve the speed of rule matching. Using the five-tuple information as the read address of the block RAM can improve the accuracy of message matching compared to the hash matching algorithm in the prior art. Using the block RAM inside the FPGA to store the matching rule to implement the rule matching function of the message, without using the technical solution of TCAM, can reduce the cost of the product. For application scenarios of message processing that do not require a high number of matching rules, such as message filtering of smart network cards, this solution has the advantage of low cost.

[0038] like Figure 2 As shown, an embodiment of the present application determines at least one storage address corresponding to the matching rule according to the valid bits of the mask in the matching rule and the corresponding keyword, including steps S201-S203.

[0039] S201: Obtain a keyword and a corresponding mask in a matching rule, and determine multiple valid bits in the mask, where the value of each bit in the mask indicates whether the same bit in the keyword is valid. A valid bit is a bit with a mask value of 1, and an invalid bit is a bit with a mask value of 0.

[0040] S202: Among the bits of the keyword, each bit position that is identical to each ineffective bit is represented by a pending value, and each bit position that is identical to each effective bit is left unchanged, with the pending value being 0 or 1.

[0041] S203 , determining different bit value combinations based on different values of the pending values of each bit and the bit values of the bits that remain unchanged, and using the different bit value combinations to represent each storage address of the block RAM corresponding to the matching rule.

[0042] For example, the configuration of matching rule 0 is: rule number 0, keyword 0x80, and corresponding mask 0xF0. The binary form of mask 0xF0 is 11110000. The insignificant bits with bit values of 0 in the mask are bits 3, 2, 1, and 0, and the valid bits with bit values of 1 are bits 7, 6, 5, and 4. The binary form of the keyword 0x80 is 10000000. Therefore, bits 3, 2, 1, and 0 in 0x80 are represented by undetermined values, represented by *. The bit values of bits 7, 6, 5, and 4 in 0x80 remain unchanged, that is, the bit values of bits 7, 6, 5, and 4 are still 1, 0, 0, 0. The binary format of multiple storage addresses of the corresponding block RAM is 1000****. The value of the undetermined value * is 0 or 1. Different values of the undetermined value * can form multiple combinations, for example, 10000000, 10000001, 10000010, 10000011, etc., that is, the storage addresses of the block RAM are 0x80 to 0x8F.

[0043] In a specific embodiment of the present application, the configuration of matching rule 0 is: rule number 0, keyword 0x80, and corresponding mask 0xF0; the configuration of matching rule 1 is: rule number 1, keyword 0x82, and corresponding mask 0xFF; the configuration of matching rule 71 is: rule number 71, keyword 0x00, and corresponding mask 0x00. The address of the block RAM is 0x00~0xFF, and the bits are 0~71. The matching rules in the block RAM are configured based on the above Figure 2 In the embodiment shown, the storage address of the block RAM is determined to be 0x80 to 0x8F according to matching rule 0, the storage address of the block RAM is determined to be 0x82 according to matching rule 1, and the storage address of the block RAM is determined to be 0x00 to 0xFF according to matching rule 71. Therefore, the matching rules in the block RAM perform the following operations: write 1 to bit 0 of the storage address 0x80 to 0x8F, write 1 to bit 1 of the storage address 0x82, and write 1 to bit 71 of the storage address 0x00 to 0xFF. That is, the matching rules of the block RAM are:

[0044] 0x00~0x7F:0x80_0000_0000_0000_0000;

[0045] 0x80~0x81:0x80_0000_0000_0000_0001;

[0046] 0x82:0x80_0000_0000_0000_0003;

[0047] 0x83~0x8F:0x80_0000_0000_0000_0001;

[0048] 0x90~0xFF:0x80_0000_0000_0000_0000;

[0049] Based on the block RAM configured according to the above rules, assuming that the protocol number in the obtained message is 0x82, and 0x82 is used as the read address of the block RAM, the read value is 0x80_0000_0000_0000_0003, which means that the message matches rules 0, 1, and 71.

[0050] When matching packets, multiple rules can be combined and packets can be matched based on the combined rules to meet the requirements of packet filtering in various application scenarios. For example, the combination matching of source port and protocol number, the combination matching of destination port and protocol number, etc. Figure 3 As shown, in one embodiment of the present application, the FPGA includes a first block of RAM, a second block of RAM, and a third block of RAM, the keywords are the high eight bits of the source port, the low eight bits of the source port, and the protocol number, the masks correspond to the high eight bits mask of the source port, the low eight bits mask of the source port, and the protocol number mask, respectively, and the steps of configuring the matching rules specifically include steps S301-S303.

[0051] S301, for each first matching rule corresponding to the upper eight bits of a source port, determine, according to the first matching rule, each first significant bit in the upper eight bits mask of the source port, determine, according to each first significant bit and the upper eight bits of the source port, each storage address of the first block of RAM corresponding to the first matching rule, determine, according to the rule number of the first matching rule, the bit to be configured among the N bits of each storage address, and write, into the bit to be configured, the effective bit value indicating that the first matching rule is effective;

[0052] S302: For each second matching rule corresponding to the lower eight bits of the source port, determine, according to the second matching rule, each second significant bit in the lower eight bits of the source port mask; determine, according to each second significant bit and the lower eight bits of the source port, each storage address of the second block of RAM corresponding to the second matching rule; determine, according to the rule number of the second matching rule, the bit to be configured among the N bits of each storage address; and write, into the bit to be configured, the effective bit value indicating that the second matching rule is effective;

[0053] S303, for each third matching rule corresponding to a protocol number, determine each third valid bit according to the protocol number mask in the third matching rule, determine each storage address of the third block of RAM corresponding to the third matching rule according to each third valid bit and the protocol number, determine the bit to be configured among the N bits of each storage address according to the rule number of the third matching rule, and write the effective bit value used to represent the effectiveness of the third matching rule into the bit to be configured.

[0054] In the embodiment of the present application, the keyword in the matching rule is the source port keyword, and the mask corresponds to the source port mask. The address of the block RAM supports a length of one byte, that is, 0x00~0xFF, and the byte length of the source port is two bytes. Therefore, two identical block RAMs are required to implement the configuration of the matching rule of the source port, that is, the first RAM and the second block RAM in the embodiment of the present application. Based on the implementation method of steps S301 and S302, the configuration of the matching rule of the source port is completed in the first RAM and the second block RAM. It can be understood that this embodiment uses two block RAMs, the first RAM and the second block RAM, to implement the configuration of the matching rule of the source port. In the implementation method of the matching rule configuration of the source port, the number of block RAMs required is an example. The number of block RAMs can be determined based on the byte length of the single block RAM address and the byte length of the source port. The specific number can be set according to the actual situation and is not limited here.

[0055] In the embodiment of the present application, the keyword in the matching rule is the protocol number, and the mask corresponds to the protocol number mask. The block RAM address supports a one-byte length, that is, 0x00 to 0xFF. The byte length of the protocol number is one byte, so a block RAM is required to implement the configuration of the protocol number matching rule, that is, the third block RAM in the embodiment of the present application. Based on the implementation of step S303, the configuration of the protocol number matching rule is completed in the third block RAM.

[0056] like Figure 4 As shown, an embodiment of the present application determines the rule number of at least one matching rule hit by a received message based on at least one valid bit value, including steps S401 to S405.

[0057] S401, parse the received message and obtain the source port and protocol number in the message;

[0058] S402, using the high-order 8 bits of the source port as the storage address of the first RAM, reading multiple valid bit values corresponding to the storage address, and determining the rule number of each first matching rule hit by the high-order 8 bits of the source port based on each valid bit value, the rule number being represented by a first rule number;

[0059] S403, using the lower 8 bits of the source port data as a storage address of the second RAM, reading multiple valid bit values corresponding to the storage address, and determining the rule number of each second matching rule hit by the lower 8 bits of the source port data based on each valid bit value, the rule number being represented by a second rule number;

[0060] S404: Using the protocol number in the message as a storage address of the third RAM, reading multiple valid bit values corresponding to the storage address, and determining the rule number of each third matching rule hit by the protocol number based on each valid bit value, the rule number being represented by a third rule number.

[0061] S405, based on each first rule number, each second rule number and each third rule number, determine at least one rule number that hits the first matching rule, the second matching rule and the third matching rule at the same time, and based on the priority of the matching rule, determine the rule number with the highest priority from the at least one rule number as the rule number of the matching rule hit by the received message.

[0062] In the embodiment of the present application, based on the above Figure 3 In the embodiment shown, the configuration of the matching rules of the source ports of the first RAM and the second RAM, as well as the configuration of the matching rules of the protocol number in the third RAM, combines the source port and the protocol number in the message for rule matching. Specifically, the high 8-bit data of the source port in the message is used as the storage address of the first RAM to obtain each first rule number that meets the matching rule, the low 8-bit data of the source port in the message is used as the storage address of the second RAM to obtain each second rule number that meets the matching rule, the protocol number in the message is used as the storage address of the third RAM to obtain each third rule number that meets the matching rule, and based on each first rule number, each second rule number and each third rule number, at least one rule number that simultaneously hits the first matching rule, the second matching rule and the third matching rule is determined, and based on the priority of the matching rule, the rule number with the highest priority is determined from the at least one rule number as the rule number of the matching rule hit by the received message. This embodiment implements the rule configuration of the source port and protocol number through the first block of RAM, the second block of RAM and the third block of RAM, which can achieve the matching of the matching rules of the combination of the source port and the protocol number, and realize the data filtering of the matching rules of the combination of the source port and the protocol number in the message.

[0063] like Figure 5 As shown, in one embodiment of the present application, the FPGA includes a fourth RAM, a fifth RAM, and a sixth RAM, the keywords are the high eight bits of the destination port, the low eight bits of the destination port, and the protocol number, the masks correspond to the high eight bits mask of the destination port, the low eight bits mask of the destination port, and the protocol number mask, respectively, and the steps of configuring the matching rules specifically include S501-S503.

[0064] S501: For each fourth matching rule corresponding to the upper eight bits of a destination port, determine, based on the fourth matching rule, each fourth significant bit in the upper eight bits mask of the destination port; determine, based on each fourth significant bit and the upper eight bits of the destination port, each storage address of the fourth RAM corresponding to the fourth matching rule; determine, based on the rule number of the fourth matching rule, the bit to be configured among the N bits of each storage address; and write, into the bit to be configured, an effective bit value indicating that the fourth matching rule is effective.

[0065] S502: For each fifth matching rule corresponding to the lower eight bits of the destination port, determine, based on the fifth matching rule, each fifth significant bit in the lower eight bits mask of the destination port; determine, based on each fifth significant bit and the lower eight bits of the destination port, each storage address of the fifth RAM block corresponding to the fifth matching rule; determine, based on the rule number of the fifth matching rule, the bit to be configured among the N bits of each storage address; and write, into the bit to be configured, the effective bit value indicating that the fifth matching rule is effective;

[0066] S503, for each sixth matching rule corresponding to a protocol number, determine each sixth valid bit according to the protocol number mask in the sixth matching rule, determine each storage address of the sixth block of RAM corresponding to the sixth matching rule according to each sixth valid bit and the protocol number, determine the bit to be configured among the N bits of each storage address according to the rule number of the sixth matching rule, and write the effective bit value used to represent the effectiveness of the sixth matching rule into the bit to be configured.

[0067] In the embodiment of the present application, the keyword in the matching rule is the destination port keyword, and the mask corresponds to the destination port mask. The block RAM address supports a one-byte length, i.e., 0x00 to 0xFF. The byte length of the destination port is two bytes. Therefore, two identical block RAMs are required to configure the matching rule for the destination port, i.e., the fourth and fifth blocks of RAM in the embodiment of the present application. Based on the implementation of steps S501 and S502, the configuration of the matching rule for the destination port is completed in the fourth and fifth blocks of RAM.

[0068] In this embodiment of the present application, the keyword in the matching rule is the protocol number, and the mask corresponds to the protocol number mask. The block RAM address supports a one-byte length, that is, 0x00 to 0xFF, and the byte length of the protocol number is two bytes. Therefore, a block RAM is required to implement the configuration of the protocol number matching rule, that is, the sixth block RAM in this embodiment of the present application. Based on the implementation of step S503, the configuration of the protocol number matching rule is completed in the sixth block RAM.

[0069] like Figure 6As shown, an embodiment of the present application determines the rule number of at least one matching rule hit by a received message based on at least one valid bit value, including steps S601-S605.

[0070] S601, parse the received message and obtain the destination port and protocol number in the message;

[0071] S602: Using the high-order 8 bits of the destination port as a storage address of a fourth RAM block, reading multiple valid bit values corresponding to the storage address, and determining, based on each valid bit value, a rule number of each fourth matching rule matched by the high-order 8 bits of the destination port, the rule number being denoted by a fourth rule number.

[0072] S603: Using the lower 8 bits of the destination port as a storage address of a fifth RAM block, reading multiple valid bit values corresponding to the storage address, and determining, based on each valid bit value, a rule number of each fifth matching rule matched by the lower 8 bits of the destination port. The rule number is denoted by a fifth rule number.

[0073] S604: Using the protocol number in the message as a storage address of the sixth RAM block, reading multiple valid bit values corresponding to the storage address, and determining the rule number of each fourth matching rule hit by the protocol number based on each valid bit value, the rule number being represented by a sixth rule number.

[0074] S605, based on each fourth rule number, each fifth rule number and each sixth rule number, determine at least one rule number that hits the fourth matching rule, the fifth matching rule and the sixth matching rule at the same time, and based on the priority of the matching rule, determine the rule number with the highest priority from the at least one rule number as the rule number of the matching rule hit by the received message.

[0075] In the embodiment of the present application, based on the above Figure 5In the illustrated embodiment, the configuration of the destination port matching rules in the fourth and fifth RAM blocks, as well as the configuration of the protocol number matching rules in the sixth RAM block, performs rule matching based on the combination of the destination port and protocol number in the message. Specifically, the high-order 8 bits of the destination port in the message are used as the storage address of the fourth RAM block to obtain each fourth rule number that matches the matching rule. The low-order 8 bits of the destination port in the message are used as the storage address of the fifth RAM block to obtain each fifth rule number that matches the matching rule. The protocol number in the message is used as the storage address of the sixth RAM block to obtain each sixth rule number that matches the matching rule. Based on each fourth rule number, each fifth rule number, and each sixth rule number, at least one rule number that simultaneously matches the fourth, fifth, and sixth matching rules is determined. Based on the priority of the matching rules, the rule number with the highest priority is determined from the at least one rule number and is used as the rule number of the matching rule matched by the received message. In this embodiment, the configuration of the destination port and protocol number rules is implemented through the fourth, fifth, and sixth RAM blocks, thereby achieving data filtering based on the matching rules of the combination of the destination port and protocol number in the message.

[0076] like Figure 7 As shown, in one embodiment of the present application, the FPGA includes 16 seventh blocks of RAM, the keyword is one of the source IP address keyword, the destination IP address keyword, and the fixed position feature code keyword, the mask corresponds to one of the source IP address mask, the destination IP address mask, and the fixed position feature code mask, the source IP address keyword, the source IP address mask, the destination IP address keyword, the destination IP address mask, the fixed position feature code keyword, and the fixed position feature code mask are all 128 bits, and the steps of configuring the matching rule specifically include:

[0077] S701: Keywords and corresponding masks are grouped into 16 groups of keywords and 16 groups of masks in descending bit order, one byte per group. For each group of keywords, the matching rule corresponding to the group of keywords is configured into a corresponding seventh RAM block among the 16 seventh RAM blocks according to the steps of configuring matching rules, thereby configuring the matching rule for the 16 seventh RAM blocks.

[0078] S702, parse the received message, obtain the keywords in the message, divide the keywords in the message into 16 groups of keywords in order from high to low bits, with one byte as a group, input each group of keywords into the corresponding seventh block RAM in 16 seventh blocks RAM in turn, and determine the matching rule hit by the received message based on the priority of the matching rule.

[0079] The above embodiment describes how to configure matching rules based on the source IP address keyword, the destination IP address keyword, and the fixed-position signature keyword. Since the source IP address, destination IP address, and fixed-position signature have the same byte length, the rule configuration method is essentially similar. This example uses the source IP address as an example.

[0080] Exemplarily, the keyword in the matching rule is the source IP address keyword, and the mask corresponds to the source IP address mask. The address of the block RAM supports a length of one byte, that is, 0x00~0xFF, and the byte length of the source IP address is 16 bytes. Therefore, 16 block RAMs are required to implement the configuration of the matching rule of the source IP address, that is, the seventh block RAM in the embodiment of the present application, and 16 seventh blocks of RAM are required. Based on the implementation method of step S701, the configuration of the matching rule of the source IP address is completed in the 16 seventh blocks of RAM for each group. Based on the configuration of the matching rule of the source IP address of the 16 seventh blocks of RAM in the above implementation method, the source IP address in the message is matched according to the rules. Specifically, the source IP addresses in the message are divided into 16 groups of source IP addresses in order of bit positions from high to low, and each group of source IP addresses is simultaneously input into the corresponding seventh RAM of the 16 seventh RAM blocks. That is, the first group of source IP addresses is input into the first seventh RAM block, and the first group of source IP addresses is used as the read address of the first seventh RAM block to read the rule number that matches the matching rule. The second group of source IP addresses is input into the second seventh RAM block, and the second group of source IP addresses is used as the read address of the second seventh RAM block to read the rule number that matches the matching rule. And so on, the rule matching of the 16 groups of source IP addresses is completed, and the rule number matched by each group of source IP addresses is obtained. Based on the priority of each matching rule, arbitration is performed, and the matching rule with the highest priority level is output, thereby determining the rule number of the matching rule hit by the received message. This embodiment implements rule configuration for source IP address, destination IP address, and fixed position feature code, and realizes data filtering of the matching rule of source IP address, destination IP address, and fixed position feature code in the message.

[0081] The configuration rules for the destination IP address and fixed location feature code are similar and can be configured according to the above implementation. This will not be described in detail here. It is understood that users can combine the source IP address, destination IP address, and fixed location feature code into rules based on their needs. The required number of block RAMs is also determined based on the number of the above three. For example, when combining the source IP address and destination IP into rules, a total of 32 block RAMs are required.

[0082] According to the above embodiments, the configuration of the source port and protocol number combination matching rules, the configuration of the destination port and protocol number combination matching rules, the configuration of the source IP address matching rules, the configuration of the destination IP address matching rules, and the configuration of the fixed position feature code matching rules are described. It can be understood that in actual applications, the above rules can be matched independently or arbitrarily combined to meet different scenario applications.

[0083] In the above embodiment, the block RAM of the FPGA is used to configure the matching rules. If the block RAM resources are insufficient, the LUT RAM (Look-Up Table Random Access Memory) inside the FPGA can be used to configure the matching rules.

[0084] like Figure 8 As shown, in one embodiment of the present application, the FPGA further includes K LUT RAMs, the LUT RAMs include multiple storage addresses, and the storage space corresponding to the storage addresses has M bits. The method further includes:

[0085] Step S801: Divide keywords and masks into K groups of sub-keywords and sub-masks, each consisting of M bits. The K groups of sub-keywords and corresponding sub-masks are constructed into K matching rule sub-tables. Each matching rule sub-table includes N matching rules, each including a rule number, a sub-keyword, and a sub-mask. For each matching rule sub-table, a matching rule configuration step is performed so that the matching rules of the matching rule sub-table are configured in the corresponding LUT RAM, thereby configuring the matching rules of the K LUT RAMs.

[0086] Step S802 : Divide the quintuple information into K groups of sub-quintuple information in groups of M bits, input the K groups of sub-quintuple information into K LUT RAMs, and determine the matching rule hit by the received message based on the priority of the matching rule.

[0087] In this embodiment, the keywords and masks are byte-split into multiple groups of sub-keywords and sub-masks, thereby obtaining multiple matching rule sub-tables. For each matching rule sub-table, matching rules are configured in a corresponding LUT RAM. During the received message matching process, the quintuple information in the message is divided into K groups of M bits each, and these K groups of sub-quintuple information are input into K LUT RAMs to determine the matching rule matched by the received message.

[0088] Exemplarily, the source port is used as an example for explanation. Assume that the depth supported by the LUT RAM is 16 and the bit supported by the LUT RAM is 4 bits, that is, M is 4. The byte length of the source port is two bytes, so 4 LUT RAMs are required to implement the configuration of the matching rules, that is, K is 4. The source port and the source port mask are divided into 4 groups of sub-source ports and sub-source port masks respectively, and 4 matching rule sub-tables are obtained accordingly. Each matching rule sub-table includes N matching rules, and each matching rule includes a rule number, a sub-source port and a sub-source port mask. For each matching rule sub-table, the step of configuring the matching rules is performed according to the above embodiment, so that the matching rules of the matching rule sub-table are configured in the corresponding LUT RAM, thereby realizing the configuration of the matching rules of the 4 LUT RAMs. Obtain the source port in the received message, divide the source port into 4 groups of sub-source port information, and input the 4 groups of sub-source ports into 4 LUT RAMs for rule matching. Each LUT RAM outputs the rule number of the matching rule hit by the message. Based on the priority of the matching rule, select the rule number with a high priority from the rule numbers of the matching rules output by the 4 LUT RAMs, and then determine the rule number of the matching rule hit by the received message.

[0089] In one embodiment of the present application, if the resources of the LUT RAM inside the FPGA cannot meet the configuration of the matching rules, the LUT DFF (LUT trigger) inside the FPGA can be used to implement the configuration of the rules. The rule configuration is implemented by byte splitting. The specific solution is basically similar to the configuration of the above-mentioned LUT RAM and will not be repeated here.

[0090] Based on the same inventive concept, an embodiment of the present application also provides an FPGA-based line-speed bit mask message matching device. The implementation solution for solving the problem provided by this device is similar to the implementation solution recorded in the above method. Therefore, the specific limitations in the embodiments of one or more FPGA-based line-speed bit mask message matching devices provided below can be found in the above limitations on the FPGA-based line-speed bit mask message matching method, and will not be repeated here.

[0091] Please refer to Figure 9 An embodiment of the present application provides a line-speed bit mask message matching device based on an FPGA, wherein the FPGA includes at least one block RAM, the block RAM includes multiple storage addresses, and the storage space corresponding to the storage address has N bits. The device also includes:

[0092] Acquisition module 901, for acquiring N preset matching rules, each matching rule including a rule number, a keyword, and a mask corresponding to the keyword, the rule number is 0 to N-1, and N is a natural number;

[0093] A rule configuration module 902 is configured to configure the matching rules in the block RAM according to the N matching rules. The matching rule configuration steps include: for each matching rule, determining at least one storage address corresponding to the matching rule based on the valid bits of the mask in the matching rule and the corresponding keyword, determining the bit to be configured among the N bits of the storage address based on the rule number of the matching rule, and writing an effective bit value to indicate that the matching rule is effective into the bit to be configured;

[0094] The message matching module 903 is used to parse the received message to generate quintuple information, use the quintuple information as the storage address of the block RAM, read multiple valid bit values corresponding to the storage address, and determine the rule numbers of each matching rule hit by the received message based on the respective bits corresponding to the respective valid bit values.

[0095] Furthermore, the rule configuration module 902 is specifically configured to:

[0096] Obtain a keyword and a corresponding mask in the matching rule, and determine multiple valid bits in the mask, wherein the value of each bit in the mask indicates whether the same bit in the keyword is valid, and a valid bit is a bit with a mask value of 0;

[0097] In each bit of the keyword, each bit at the same bit position as each valid bit is represented by a pending value, and the bit values of the remaining bits remain unchanged, and the pending value is 0 or 1;

[0098] Different bit value combinations are determined based on different values of the undetermined values of each bit and the bit values of the bits that remain unchanged, and the different bit value combinations are used to represent multiple storage addresses of the block RAM.

[0099] Furthermore, the FPGA includes a first RAM, a second RAM, and a third RAM. The keywords are the high eight bits of the source port, the low eight bits of the source port, and the protocol number. The masks correspond to the high eight bits of the source port, the low eight bits of the source port, and the protocol number mask, respectively. The rule configuration module 902 is specifically used to:

[0100] For the first matching rule corresponding to the upper eight bits of each source port, determine, according to the first matching rule, each first significant bit in the upper eight bits mask of the source port, determine, according to each first significant bit and the upper eight bits of the source port, each storage address of the first block of RAM corresponding to the first matching rule, determine, according to the rule number of the first matching rule, the bit to be configured among the N bits of each storage address, and write, into the bit to be configured, the effective bit value used to indicate that the first matching rule is effective;

[0101] For the second matching rule corresponding to the lower eight bits of each source port, determine each second significant bit in the lower eight bit mask of the source port according to the second matching rule, determine each storage address of the second block of RAM corresponding to the second matching rule based on each second significant bit and the lower eight bits of the source port, determine the bit to be configured among the N bits of each storage address using the rule number of the second matching rule, and write the effective bit value used to indicate the effectiveness of the second matching rule into the bit to be configured;

[0102] For the third matching rule corresponding to each protocol number, determine each third valid bit according to the protocol number mask in the third matching rule, determine each storage address of the third block RAM corresponding to the third matching rule according to each third valid bit and the protocol number, determine the bit to be configured among the N bits of each storage address according to the rule number of the third matching rule, and write the effective bit value used to represent the effectiveness of the third matching rule in the bit to be configured.

[0103] Furthermore, the message matching module 903 is specifically configured to:

[0104] Parsing the received message to obtain the source port and protocol number in the message;

[0105] Using the high-order 8 bits of the source port as the storage address of the first RAM, reading multiple valid bit values corresponding to the storage address, and determining the rule number of each first matching rule hit by the high-order 8 bits of the source port based on each valid bit value, the rule number being represented by a first rule number;

[0106] Using the lower 8 bits of the source port as a storage address of the second RAM, reading multiple valid bit values corresponding to the storage address, and determining the rule number of each second matching rule hit by the lower 8 bits of the source port based on each valid bit value, the rule number being represented by a second rule number;

[0107] Using the protocol number as the storage address of the third RAM block, reading multiple valid bit values corresponding to the storage address, and determining the rule number of each third matching rule hit by the protocol number based on each valid bit value, the rule number being represented by a third rule number;

[0108] Based on each first rule number, each second rule number, and each third rule number, determine at least one rule number that simultaneously hits the first matching rule, the second matching rule, and the third matching rule. Based on the priority of the matching rule, determine the rule number with the highest priority from the at least one rule number as the rule number of the matching rule hit by the received message.

[0109] Furthermore, the FPGA includes a fourth RAM, a fifth RAM, and a sixth RAM. The keywords are the high eight bits of the destination port, the low eight bits of the destination port, and the protocol number. The masks correspond to the high eight bits of the destination port, the low eight bits of the destination port, and the protocol number mask, respectively. The rule configuration module 902 is specifically configured to:

[0110] For each fourth matching rule corresponding to the upper eight bits of the destination port, determine each fourth significant bit in the upper eight bits mask of the destination port according to the fourth matching rule, determine each storage address of the fourth RAM corresponding to the fourth matching rule based on each fourth significant bit and the upper eight bits of the destination port, determine the bit to be configured among the N bits of each storage address using the rule number of the fourth matching rule, and write the effective bit value used to indicate the effectiveness of the fourth matching rule into the bit to be configured;

[0111] For each fifth matching rule corresponding to the lower eight bits of the destination port, determine each fifth significant bit in the lower eight bits mask of the destination port according to the fifth matching rule, determine each storage address of the fifth RAM corresponding to the fifth matching rule based on each fifth significant bit and the lower eight bits of the destination port, determine the bit to be configured among the N bits of each storage address using the rule number of the fifth matching rule, and write the effective bit value used to indicate the effectiveness of the fifth matching rule into the bit to be configured;

[0112] For the sixth matching rule corresponding to each protocol number, determine each sixth valid bit according to the protocol number mask in the sixth matching rule, determine each storage address of the sixth block of RAM corresponding to the sixth matching rule according to each sixth valid bit and the protocol number, determine the bit to be configured among the N bits of each storage address according to the rule number of the sixth matching rule, and write the effective bit value to represent the effectiveness of the sixth matching rule into the bit to be configured.

[0113] Furthermore, the message matching module 903 is specifically configured to:

[0114] Parse the received message and obtain the destination port and protocol number in the message;

[0115] Using the high-order 8 bits of the destination port as a storage address of a fourth RAM block, reading multiple valid bit values corresponding to the storage address, and determining, based on each valid bit value, a rule number of each fourth matching rule matched by the high-order 8 bits of the destination port, the rule number being denoted by a fourth rule number;

[0116] Using the lower 8 bits of the destination port as a storage address of the fifth RAM, reading multiple valid bit values corresponding to the storage address, and determining, based on each valid bit value, a rule number of each fifth matching rule matched by the lower 8 bits of the destination port, the rule number being denoted by a fifth rule number;

[0117] Using the protocol number as the storage address of the sixth RAM block, reading multiple valid bit values corresponding to the storage address, and determining the rule number of each sixth matching rule hit by the protocol number based on each valid bit value, the rule number being represented by the sixth rule number;

[0118] Based on each fourth rule number, each fifth rule number and each sixth rule number, determine at least one rule number that simultaneously hits the fourth matching rule, the fifth matching rule and the sixth matching rule, and based on the priority of the matching rule, determine the rule number with the highest priority from the at least one rule number as the rule number of the matching rule hit by the received message.

[0119] Furthermore, the FPGA includes 16 seventh blocks of RAM, the keyword is one of the source IP address keyword, the destination IP address keyword, and the fixed position feature code keyword, the mask corresponds to one of the source IP address mask, the destination IP address mask, and the fixed position feature code mask, the source IP address keyword, the source IP address mask, the destination IP address keyword, the destination IP address mask, the fixed position feature code keyword, and the fixed position feature code mask are all 128 bits, and the rule configuration module 902 is specifically used to: divide the keyword and the corresponding mask into 16 groups of keywords and 16 groups of masks in order from high to low bits, with one byte as a group, for each group of keywords, according to the steps of configuring the matching rules, configure the matching rules corresponding to the group of keywords to the corresponding seventh block of RAM in the 16 seventh blocks of RAM to realize the configuration of the matching rules of the 16 seventh blocks of RAM. The message matching module 903 is specifically used to: parse the received message, obtain the keywords in the message, divide the keywords in the message into 16 groups of keywords in order from high to low bits with one byte as a group, input each group of keywords into the corresponding seventh block RAM in the 16 seventh blocks RAM, and determine the matching rule hit by the received message based on the priority of the matching rule.

[0120] Furthermore, the FPGA includes K LUT RAMs, each of which includes multiple storage addresses, each of which has M bits corresponding to a storage space. The rule configuration module 902 is specifically configured to: divide the keyword and mask into K groups of sub-keywords and sub-masks, each of which consists of M bits; construct the K groups of sub-keywords and corresponding sub-masks into K matching rule sub-tables, each of which includes N matching rules, each of which includes a rule number, a sub-keyword, and a sub-mask; and perform a matching rule configuration step for each matching rule sub-table, so that the matching rules of the matching rule sub-table are configured in the corresponding LUT RAM, thereby configuring the matching rules of the K LUT RAMs. The message matching module 903 is specifically configured to: divide the quintuple information into K groups of sub-quintuple information, each of which consists of M bits; input the K groups of sub-quintuple information into the K LUT RAMs; and determine the matching rule hit by the received message based on the priority of the matching rules.

[0121] As an example, see Figure 10, which shows a schematic diagram of the structure of a communication device provided in an embodiment of the present application. The network device includes an FPGA-based line-speed bit-mask message matching device 1001, a communication interface 1002, a processor 1003, a memory 1004, and a bus 1005. The processor 1003, the memory 1004, the communication interface 1002, and the FPGA-based line-speed bit-mask message matching device 1001 are communicatively connected to each other via the bus 1005. The memory 1004 can be used to store computer programs, which can include instructions and data. In the embodiment of the present application, the memory 1004 can be various types of storage media, such as random access memory, static random access memory, non-volatile RAM, DDR, etc. The memory 1004 can include a hard disk and / or internal memory. The processor 1003 can be a general-purpose processor, which can be a processor that performs specific steps and / or operations by reading and executing a computer program stored in a memory (e.g., memory 1004). The general-purpose processor is used to process data output by the FPGA-based line-speed bit-mask message matching device 1001. A general-purpose processor may be, for example, but not limited to, a central processing unit. In addition, the processor 1003 may also be a dedicated processor. A dedicated processor may be a processor specially designed to perform specific steps and / or operations. A dedicated processor may be, for example, but not limited to, an ASIC and an FPGA. In addition, the processor 1003 may also be a combination of multiple processors, such as a multi-core processor. The communication interface 1002 may include input / output interfaces, physical interfaces, and logical interfaces for interconnecting devices within the network device, as well as interfaces for interconnecting the network device with other devices (such as network devices). The physical interface may be a Gigabit Ethernet interface, which may be used to interconnect the network device with other devices. The logical interface is an interface within the network device, which may be used to interconnect devices within the network device. The bus 1005 may be of any type, for example, a system bus for interconnecting the processor 1003, the memory 1004, the communication interface 1002, and the FPGA-based line-speed bit mask message matching device 1001. The structure of the FPGA-based line-speed bit mask message matching device 1001 can refer to Figure 9 The interconnection between any one of the processor 1003, memory 1004, and communication interface 1002 and the FPGA-based line-speed bit mask message matching device 1001 may specifically refer to the interconnection between any one of the processor 1003, memory 1004, and communication interface 1002 and the FPGA-based line-speed bit mask message matching device 1001.

[0122] The embodiments disclosed in the present application also provide a computer-readable storage medium having instructions stored therein. When the computer-readable storage medium is executed on a computer, the computer is enabled to execute the FPGA-based line-speed bit mask message matching method described in any one of the above embodiments.

[0123] Although the preferred embodiments of the present application have been disclosed for illustrative purposes, those skilled in the art will appreciate that various modifications, additions and substitutions are possible, without departing from the scope and spirit of the application as disclosed in the accompanying claims.

Claims

1. A line-speed bit mask message matching method based on FPGA, characterized in that: The FPGA includes at least one block RAM, the block RAM includes a plurality of storage addresses, and the storage space corresponding to the storage address has N bits. The method includes: Obtain N preset matching rules, each matching rule including a rule number, a keyword, and a mask corresponding to the keyword, the rule number is 0 to N-1, and N is a natural number; Performing configuration of matching rules in the block RAM according to the N matching rules, the matching rule configuration step comprising: for each matching rule, determining at least one storage address corresponding to the matching rule based on valid bits of a mask in the matching rule and a corresponding keyword, determining a bit to be configured among the N bits of the storage address based on the rule number of the matching rule, and writing an effective bit value indicating that the matching rule is effective into the bit to be configured; Parsing the received message to generate quintuple information, using the quintuple information as the storage address of the block RAM, reading multiple valid bit values corresponding to the storage address, and determining the rule number of each matching rule hit by the received message based on each bit corresponding to each valid bit value; The step of determining at least one storage address corresponding to the matching rule according to the valid bits of the mask in the matching rule and the corresponding keyword includes: Obtain a keyword and a corresponding mask in the matching rule, and determine multiple valid bits in the mask, wherein the value of each bit in the mask represents whether the same bit in the keyword is valid, the valid bit is a bit with a mask value of 1, and the invalid bit is a bit with a mask value of 0; In each bit of the keyword, each bit having the same bit position as each ineffective bit is represented by a pending value, and the value of each bit having the same bit position as each effective bit remains unchanged, and the pending value is 0 or 1; Different bit value combinations are determined based on the different values of the pending values of each bit and the bit values of the bits that remain unchanged, and the different bit value combinations are used to represent multiple storage addresses of the block RAM corresponding to the matching rule.

2. The FPGA-based line-speed bit mask message matching method according to claim 1, wherein: The FPGA includes a first RAM, a second RAM, and a third RAM. The keywords are the high eight bits of the source port, the low eight bits of the source port, and the protocol number. The masks correspond to the high eight bits of the source port, the low eight bits of the source port, and the protocol number mask, respectively. The steps of configuring the matching rule specifically include: For the first matching rule corresponding to the upper eight bits of each source port, determine, according to the first matching rule, each first significant bit in the upper eight bits mask of the source port, determine, according to each first significant bit and the upper eight bits of the source port, each storage address of the first block of RAM corresponding to the first matching rule, determine, according to the rule number of the first matching rule, a bit to be configured among the N bits of each storage address, and write, into the bit to be configured, an effective bit value indicating that the first matching rule is effective; For each second matching rule corresponding to the lower eight bits of the source port, determine, according to the second matching rule, each second significant bit in the lower eight bits mask of the source port; determine, according to each second significant bit and the lower eight bits of the source port, each storage address of the second block of RAM corresponding to the second matching rule; determine, according to the rule number of the second matching rule, a bit to be configured among the N bits of each storage address; and write, into the bit to be configured, an effective bit value indicating that the second matching rule is effective; For the third matching rule corresponding to each protocol number, each third valid bit is determined according to the protocol number mask in the third matching rule, and each storage address of the third block of RAM corresponding to the third matching rule is determined according to each third valid bit and the protocol number. The bit to be configured among the N bits of each storage address is determined according to the rule number of the third matching rule, and the effective bit value used to represent the effectiveness of the third matching rule is written into the bit to be configured.

3. The FPGA-based line-speed bit mask message matching method according to claim 2, wherein: Determining a rule number of at least one matching rule hit by the received message based on the at least one valid bit value includes: Parsing the received message to obtain the source port and protocol number in the message; Using the high-order 8 bits of the source port as a storage address of the first RAM, reading multiple valid bit values corresponding to the storage address, and determining, based on each valid bit value, a rule number of each first matching rule hit by the high-order 8 bits of the source port, where the rule number is represented by a first rule number; Using the lower 8 bits of the source port as a storage address of the second RAM, reading multiple valid bit values corresponding to the storage address, and determining, based on each valid bit value, a rule number of each second matching rule hit by the lower 8 bits of the source port, where the rule number is represented by a second rule number; Using the protocol number as a storage address of the third RAM block, reading multiple valid bit values corresponding to the storage address, and determining the rule number of each third matching rule hit by the protocol number based on each valid bit value, the rule number being represented by a third rule number; Based on each first rule number, each second rule number, and each third rule number, determine at least one rule number that simultaneously hits the first matching rule, the second matching rule, and the third matching rule. Based on the priority of the matching rule, determine the rule number with the highest priority from the at least one rule number as the rule number of the matching rule hit by the received message.

4. The FPGA-based line-speed bit mask message matching method according to claim 1, wherein: The FPGA includes a fourth RAM, a fifth RAM, and a sixth RAM. The keywords are the high eight bits of the destination port, the low eight bits of the destination port, and the protocol number. The masks correspond to the high eight bits mask of the destination port, the low eight bits mask of the destination port, and the protocol number mask, respectively. The steps of configuring the matching rule specifically include: For each fourth matching rule corresponding to the upper eight bits of the destination port, determine, according to the fourth matching rule, each fourth significant bit in the upper eight bits mask of the destination port; determine, according to each fourth significant bit and the upper eight bits of the destination port, each storage address of the fourth block of RAM corresponding to the fourth matching rule; determine, according to the rule number of the fourth matching rule, a bit to be configured among the N bits of each storage address; and write, into the bit to be configured, an effective bit value indicating that the fourth matching rule is effective; For each fifth matching rule corresponding to the lower eight bits of the destination port, determine, according to the fifth matching rule, each fifth significant bit in the lower eight bits mask of the destination port; determine, according to each fifth significant bit and the lower eight bits of the destination port, each storage address of the fifth block of RAM corresponding to the fifth matching rule; determine, according to the rule number of the fifth matching rule, a bit to be configured among the N bits of each storage address; and write, into the bit to be configured, an effective bit value indicating that the fifth matching rule is effective; For the sixth matching rule corresponding to each protocol number, each sixth valid bit is determined according to the protocol number mask in the sixth matching rule, and each storage address of the sixth block of RAM corresponding to the sixth matching rule is determined according to each sixth valid bit and the protocol number. The bit to be configured in the N bits of each storage address is determined according to the rule number of the sixth matching rule, and the effective bit value used to represent the effectiveness of the sixth matching rule is written into the bit to be configured.

5. The FPGA-based line-speed bit mask message matching method according to claim 4, characterized in that: Determining a rule number of at least one matching rule hit by the received message based on the at least one valid bit value includes: Parsing the received message to obtain the destination port and protocol number in the message; Using the high-order 8 bits of the destination port as a storage address of the fourth RAM, reading multiple valid bit values corresponding to the storage address, and determining, based on each valid bit value, a rule number of each fourth matching rule hit by the high-order 8 bits of the destination port, where the rule number is represented by a fourth rule number; Using the lower 8 bits of the destination port as a storage address of the fifth RAM, reading multiple valid bit values corresponding to the storage address, and determining, based on each valid bit value, a rule number of each fifth matching rule hit by the lower 8 bits of the destination port, where the rule number is represented by a fifth rule number; Using the protocol number as a storage address of the sixth RAM block, reading multiple valid bit values corresponding to the storage address, and determining the rule number of each sixth matching rule hit by the protocol number based on each valid bit value, the rule number being represented by a sixth rule number; Based on each fourth rule number, each fifth rule number and each sixth rule number, determine at least one rule number that simultaneously hits the fourth matching rule, the fifth matching rule and the sixth matching rule, and based on the priority of the matching rule, determine the rule number with the highest priority from the at least one rule number as the rule number of the matching rule hit by the received message.

6. The FPGA-based line-speed bit mask message matching method according to claim 1, wherein: The FPGA includes 16 seventh blocks of RAM, the keyword is one of a source IP address keyword, a destination IP address keyword, and a fixed position feature code keyword, the mask corresponds to one of a source IP address mask, a destination IP address mask, and a fixed position feature code mask, the source IP address keyword, the source IP address mask, the destination IP address keyword, the destination IP address mask, the fixed position feature code keyword, and the fixed position feature code mask are all 128 bits, and the steps of configuring the matching rule specifically include: The keywords and corresponding masks are divided into 16 groups of keywords and 16 groups of masks in order of bits from high to low, respectively, with one byte as a group; for each group of keywords, according to the step of configuring matching rules, the matching rules corresponding to the group of keywords are configured into corresponding seventh blocks of RAM among the 16 seventh blocks of RAM, so as to implement the configuration of the matching rules for the 16 seventh blocks of RAM; Parse the received message, obtain the keywords in the message, divide the keywords in the message into 16 groups of keywords in order from high to low bits, with one byte as a group, input each group of keywords into the corresponding seventh block RAM in the 16 seventh blocks RAM, and determine the matching rule hit by the received message based on the priority of the matching rule.

7. The FPGA-based line-speed bit mask message matching method according to claim 1, wherein: The FPGA further includes K LUT RAMs, each of which includes a plurality of storage addresses, each of which corresponds to a storage space having M bits. The step of configuring the matching rule includes: Dividing the keywords and masks into K groups of sub-keywords and sub-masks, each consisting of M bits, respectively, and constructing the K groups of sub-keywords and corresponding sub-masks into K matching rule sub-tables, each matching rule sub-table including N matching rules, each matching rule including a rule number, a sub-keyword, and a sub-mask; and performing a matching rule configuration step for each matching rule sub-table so that the matching rules of the matching rule sub-table are configured in the corresponding LUT RAM, thereby realizing the configuration of the matching rules of the K LUT RAMs; The quintuple information is divided into K groups of sub-quintuple information in groups of M bits, the K groups of sub-quintuple information are input into K LUT RAMs, and the matching rule hit by the received message is determined based on the priority of the matching rule.

8. A line-speed bit mask message matching device based on FPGA, characterized in that: The FPGA includes at least one block RAM, the block RAM includes a plurality of storage addresses, and the storage space corresponding to the storage address has N bits. The device includes: An acquisition module is used to acquire N preset matching rules, each matching rule including a rule number, a keyword, and a mask corresponding to the keyword, wherein the rule number ranges from 0 to N-1, and N is a natural number; a rule configuration module, configured to configure matching rules in the block RAM according to the N matching rules, the matching rule configuration step comprising: for each matching rule, determining at least one storage address corresponding to the matching rule based on valid bits of a mask in the matching rule and a corresponding keyword, determining a bit to be configured among the N bits of the storage address based on the rule number of the matching rule, and writing an effective bit value indicating that the matching rule is effective into the bit to be configured; a message matching module, configured to parse a received message to generate quintuple information, use the quintuple information as a storage address of the block RAM, read multiple valid bit values corresponding to the storage address, and determine the rule number of each matching rule hit by the received message based on each bit position corresponding to each valid bit value; The rule configuration module is specifically used for: Obtain a keyword and a corresponding mask in the matching rule, and determine multiple valid bits in the mask, wherein the value of each bit in the mask represents whether the same bit in the keyword is valid, the valid bit is a bit with a mask value of 1, and the invalid bit is a bit with a mask value of 0; In each bit of the keyword, each bit having the same bit position as each ineffective bit is represented by a pending value, and the value of each bit having the same bit position as each effective bit remains unchanged, and the pending value is 0 or 1; Different bit value combinations are determined based on the different values of the pending values of each bit and the bit values of the bits that remain unchanged, and the different bit value combinations are used to represent multiple storage addresses of the block RAM corresponding to the matching rule.

9. A communication device, characterized in that: It includes the FPGA-based line-speed bit mask message matching device as described in claim 8.

Images